software steht so weit.
jetzt build + docker build und testen
This commit is contained in:
br committed
1 parent
42f0c0accb
commit
ca6cdcca63
90 files changed
+10298
-480
No files matched your search
Executable
+26
@@ -0,0 +1,26 @@
|
||||
#!/usr/bin/env bash
|
||||
# Baut die Release-Binaries für Linux (amd64 + arm64) samt SHA256SUMS.
|
||||
#
|
||||
# deploy/build.sh # Version aus `git describe`
|
||||
# VERSION=v0.1.0 deploy/build.sh
|
||||
#
|
||||
# Ausgabe: dist/<version>/sultan_linux_{amd64,arm64} und dist/<version>/SHA256SUMS
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
VERSION="${VERSION:-$(git describe --tags --always --dirty)}"
|
||||
ARCHS="${ARCHS:-amd64 arm64}"
|
||||
OUT="dist/${VERSION}"
|
||||
|
||||
rm -rf "$OUT"
|
||||
mkdir -p "$OUT"
|
||||
for arch in $ARCHS; do
|
||||
echo "==> linux/${arch} (${VERSION})"
|
||||
CGO_ENABLED=0 GOOS=linux GOARCH="$arch" \
|
||||
go build -trimpath -ldflags "-s -w -X sultan/pkg/cli.Version=${VERSION}" \
|
||||
-o "${OUT}/sultan_linux_${arch}" .
|
||||
done
|
||||
(cd "$OUT" && sha256sum sultan_linux_* > SHA256SUMS)
|
||||
|
||||
echo "==> fertig: ${OUT}"
|
||||
cat "${OUT}/SHA256SUMS"
|
||||
@@ -0,0 +1,9 @@
|
||||
# Image: lokal gebaut (docker build -t sultan:latest .) oder aus der Registry
|
||||
SULTAN_IMAGE=sultan:latest
|
||||
# SULTAN_IMAGE=git.everdc.eu/chmln-app-dev/sultan:v0.1.0
|
||||
|
||||
# Einladung vom Server: docker compose exec sultan-server sultan token invite --tenant=…
|
||||
SULTAN_TOKEN=
|
||||
|
||||
# Gruppe des Docker-Sockets: getent group docker | cut -d: -f3
|
||||
DOCKER_GID=
|
||||
@@ -0,0 +1,30 @@
|
||||
# sultan agent auf einem Docker-Host (Backend).
|
||||
#
|
||||
# cp .env.example .env && $EDITOR .env # SULTAN_TOKEN, DOCKER_GID
|
||||
# install -d -m 0700 -o 65532 -g 65532 suldata
|
||||
# docker compose up -d
|
||||
#
|
||||
# network_mode: host ist Absicht:
|
||||
# - Backend-Adresse: der Agent meldet die Host-IP (Route zum Server bzw.
|
||||
# --backend-interface=wt0), nicht die Container-IP aus dem Bridge-Netz.
|
||||
# - Knoten-ID: Default ist der Hostname – mit Host-Netz der des Hosts statt
|
||||
# der zufälligen Container-ID.
|
||||
services:
|
||||
sultan-agent:
|
||||
image: ${SULTAN_IMAGE:-sultan:latest}
|
||||
container_name: sultan-agent
|
||||
restart: unless-stopped
|
||||
network_mode: host
|
||||
command: ["sultan", "agent", "--data-dir=/suldata", "--config-dir=none"]
|
||||
environment:
|
||||
# Ausgabe von `sultan token invite`; nach dem ersten Start nicht mehr nötig,
|
||||
# stehen lassen ist harmlos.
|
||||
SULTAN_TOKEN: ${SULTAN_TOKEN:-}
|
||||
# Lesezugriff auf den Docker-Socket für den nonroot-User (UID 65532).
|
||||
group_add:
|
||||
- "${DOCKER_GID:?DOCKER_GID setzen: getent group docker | cut -d: -f3}"
|
||||
volumes:
|
||||
# :ro schützt nur die Socket-Datei, nicht die API – der Agent nutzt
|
||||
# ausschließlich lesende Aufrufe (Container-Liste, Events).
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- ./suldata:/suldata # node.key (0600) und node.json – persistent halten!
|
||||
@@ -0,0 +1,6 @@
|
||||
# Image: lokal gebaut (docker build -t sultan:latest .) oder aus der Registry
|
||||
SULTAN_IMAGE=sultan:latest
|
||||
# SULTAN_IMAGE=git.everdc.eu/chmln-app-dev/sultan:v0.1.0
|
||||
|
||||
# Adresse, unter der Agents den Server erreichen – steckt danach in jeder Einladung
|
||||
SULTAN_PUBLIC_URL=https://webproxy11.example.de:8443
|
||||
@@ -0,0 +1,27 @@
|
||||
# sultan server auf dem Ingress-Knoten (neben Traefik).
|
||||
#
|
||||
# cp .env.example .env && $EDITOR .env
|
||||
# install -d -m 0700 -o 65532 -g 65532 suldata # Datenverzeichnis für den nonroot-User
|
||||
# docker compose up -d
|
||||
# docker compose exec sultan-server sultan token tenant add …
|
||||
#
|
||||
# Traefik (Host-Netz oder Binary) pollt http://127.0.0.1:8080/v1/traefik-config.
|
||||
services:
|
||||
sultan-server:
|
||||
image: ${SULTAN_IMAGE:-sultan:latest}
|
||||
container_name: sultan-server
|
||||
restart: unless-stopped
|
||||
# Im Container auf allen Interfaces lauschen; nach außen nur 127.0.0.1 veröffentlichen.
|
||||
command:
|
||||
- "sultan"
|
||||
- "server"
|
||||
- "--data-dir=/suldata"
|
||||
- "--provider-addr=:8080"
|
||||
- "--lander-addr=:8081"
|
||||
- "--public-url=${SULTAN_PUBLIC_URL}"
|
||||
ports:
|
||||
- "8443:8443" # Agents (TLS 1.3)
|
||||
- "127.0.0.1:8080:8080" # Traefik-Provider & Checkmk – Klartext, nie öffentlich
|
||||
- "127.0.0.1:8081:8081" # Lander (Hinweis-/Wartungsseiten) für Traefik
|
||||
volumes:
|
||||
- ./suldata:/suldata # sultan.db, server.key/.crt, master.key – sichern!
|
||||
Executable
+42
@@ -0,0 +1,42 @@
|
||||
#!/usr/bin/env bash
|
||||
# Baut die Binaries (deploy/build.sh) und lädt sie per rsync auf den statischen
|
||||
# Webhost (z. B. inst.chmln.de):
|
||||
#
|
||||
# TARGET=deploy@webdocker11:/srv/inst/htdocs deploy/publish-static.sh
|
||||
# STABLE=1 TARGET=… deploy/publish-static.sh # zusätzlich als "stable" markieren
|
||||
#
|
||||
# Ablage unter ${TARGET}/sultan/:
|
||||
# releases/<version>/sultan_linux_{amd64,arm64}
|
||||
# releases/<version>/SHA256SUMS
|
||||
# releases/stable → enthält die stabile Version (nur mit STABLE=1)
|
||||
#
|
||||
# Ältere Versionen bleiben liegen und damit herunterladbar.
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
: "${TARGET:?TARGET setzen, z. B. TARGET=deploy@webdocker11:/srv/inst/htdocs}"
|
||||
VERSION="${VERSION:-$(git describe --tags --always --dirty)}"
|
||||
export VERSION
|
||||
|
||||
case "$VERSION" in
|
||||
*-dirty)
|
||||
echo "Arbeitsverzeichnis hat uncommittete Änderungen (${VERSION}) – erst committen." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
deploy/build.sh
|
||||
|
||||
stage="$(mktemp -d)"
|
||||
trap 'rm -rf "$stage"' EXIT
|
||||
mkdir -p "${stage}/sultan/releases/${VERSION}"
|
||||
cp "dist/${VERSION}"/* "${stage}/sultan/releases/${VERSION}/"
|
||||
if [ "${STABLE:-0}" = 1 ]; then
|
||||
echo "$VERSION" > "${stage}/sultan/releases/stable"
|
||||
fi
|
||||
chmod -R a+rX "$stage"
|
||||
|
||||
# Ohne --delete: bereits veröffentlichte Versionen bleiben erhalten.
|
||||
rsync -rlv --chmod=Da+rx,Fa+r "${stage}/" "${TARGET}/"
|
||||
|
||||
echo "==> veröffentlicht: sultan/releases/${VERSION}"
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
# Baut das Multi-Arch-Image (amd64 + arm64) und schiebt es in die
|
||||
# Container-Registry von Gitea.
|
||||
#
|
||||
# docker login git.everdc.eu # einmalig, Gitea-User + Token mit write:package
|
||||
# deploy/push-image.sh # Tag aus `git describe`
|
||||
# LATEST=1 deploy/push-image.sh # zusätzlich :latest setzen (nur für Releases)
|
||||
#
|
||||
# Ergebnis: ${REGISTRY}/${OWNER}/sultan:<version> (und ggf. :latest)
|
||||
set -euo pipefail
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
REGISTRY="${REGISTRY:-git.everdc.eu}"
|
||||
OWNER="${OWNER:-chmln-app-dev}"
|
||||
IMAGE="${REGISTRY}/${OWNER}/sultan"
|
||||
VERSION="${VERSION:-$(git describe --tags --always --dirty)}"
|
||||
PLATFORMS="${PLATFORMS:-linux/amd64,linux/arm64}"
|
||||
|
||||
case "$VERSION" in
|
||||
*-dirty)
|
||||
echo "Arbeitsverzeichnis hat uncommittete Änderungen (${VERSION}) – erst committen." >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
tags=(-t "${IMAGE}:${VERSION}")
|
||||
if [ "${LATEST:-0}" = 1 ]; then
|
||||
tags+=(-t "${IMAGE}:latest")
|
||||
fi
|
||||
|
||||
# Multi-Arch-Builds brauchen einen buildx-Builder mit docker-container-Treiber.
|
||||
if ! docker buildx inspect sultan-builder >/dev/null 2>&1; then
|
||||
docker buildx create --name sultan-builder --driver docker-container >/dev/null
|
||||
fi
|
||||
|
||||
docker buildx build --builder sultan-builder \
|
||||
--platform "$PLATFORMS" \
|
||||
--build-arg VERSION="$VERSION" \
|
||||
"${tags[@]}" \
|
||||
--push .
|
||||
|
||||
echo "==> gepusht: ${IMAGE}:${VERSION}"
|
||||
docker buildx imagetools inspect "${IMAGE}:${VERSION}" | head -n 3
|
||||
Reference in new issue
Block a user